Overview
The Windows Multi Certificate Install Policy lets you deploy one or more certificates to Windows devices using a single policy. This is useful for:
Bring Your Own Device (BYOD) scenarios
Company-owned Windows devices
Environments where devices need multiple certificates (for Wi‑Fi, VPN, applications, etc.)
This policy is designed to simplify certificate deployment by grouping multiple certificates into one configuration instead of managing separate policies for each certificate.
Key capabilities
Multiple certificates in one policy
Deploy one or many certificates together as part of the same configuration.Flexible device ownership
Works for both:Company-owned Windows devices
Employee-owned (BYOD) Windows devices
Modern Windows support
Minimum OS: Windows 10 or later
Platform: Windows
Requirements
Minimum operating system: Windows 10 or later
Supported platform: Windows
Ownership types supported:
Company-owned
BYOD
Policy fields
Certificates
Display name: Certificates
Required: Yes
Description:
Defines the list of certificates that will be installed on the device. You can include a single certificate or multiple certificates in the same policy.
Each certificate entry must contain an Encoded Certificate value.
What it does:
Installs all specified certificates on the target Windows device(s) when the policy is applied.Typical uses:
Deploying a root or intermediate CA certificate to all devices
Installing client authentication certificates for VPN or Wi‑Fi
Distributing application-specific certificates
Encoded Certificate
Display name: Encoded Certificate
Required: Yes (for each certificate entry)
Description:
The certificate content, provided as a Base64‑encoded value in PEM format.
The certificate must:
Be in PEM format
Be Base64‑encoded
This value represents the actual certificate that will be installed on the device.
How this policy is applied
When this policy is assigned to a Windows device:
The system reads the Certificates list from the policy.
For each certificate entry, it uses the Encoded Certificate value to install that certificate on the device.
All valid certificates included in the policy are deployed together as part of the same configuration.
If you later update the policy (for example, to add or remove a certificate), the changes are applied to devices according to your organization’s normal policy update behavior.
When to use this policy
Use the Windows Multi Certificate Install Policy when:
You need to deploy several certificates at once to the same set of devices.
You want to simplify management by keeping multiple related certificates in a single policy instead of managing multiple separate policies.
You support both BYOD and company-owned Windows devices and want a unified way to distribute certificates.
Related
Windows Certificate Install Policy for single certificate installation. This policy was deprecated.